58b1777198
**问题描述：** GitHub Actions 在 frontend-security job 中报错： "Error: Unable to locate executable file: pnpm" **根本原因：** setup-node@v4 在尝试使用 pnpm cache 时，pnpm 还未安装 **解决方案：** 1. 调整步骤顺序：先安装 pnpm，再设置 Node.js 2. 升级 pnpm/action-setup 从 v2 到 v4 3. 明确指定 pnpm version: 9 **修改内容：** - 将 "Set up pnpm" 步骤移到 "Set up Node.js" 之前 - 更新 pnpm/action-setup@v2 → pnpm/action-setup@v4 - 添加 version: 9 配置 **正确的步骤顺序：** 1. Checkout 代码 2. Set up pnpm (指定版本) 3. Set up Node.js (可以使用 pnpm cache) 4. Install dependencies 相关 Issue: #174 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
63 lines
1.7 KiB
YAML
63 lines
1.7 KiB
YAML
name: Security Scan
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
schedule:
|
|
- cron: '0 3 * * 1'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
backend-security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: backend/go.mod
|
|
check-latest: false
|
|
cache-dependency-path: backend/go.sum
|
|
- name: Verify Go version
|
|
run: |
|
|
go version | grep -q 'go1.25.5'
|
|
- name: Run govulncheck
|
|
working-directory: backend
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
govulncheck ./...
|
|
- name: Run gosec
|
|
working-directory: backend
|
|
run: |
|
|
go install github.com/securego/gosec/v2/cmd/gosec@latest
|
|
gosec -severity high -confidence high ./...
|
|
|
|
frontend-security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Set up pnpm
|
|
uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 9
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
cache: 'pnpm'
|
|
cache-dependency-path: frontend/pnpm-lock.yaml
|
|
- name: Install dependencies
|
|
working-directory: frontend
|
|
run: pnpm install --frozen-lockfile
|
|
- name: Run pnpm audit
|
|
working-directory: frontend
|
|
run: |
|
|
pnpm audit --prod --audit-level=high --json > audit.json || true
|
|
- name: Check audit exceptions
|
|
run: |
|
|
python tools/check_pnpm_audit_exceptions.py \
|
|
--audit frontend/audit.json \
|
|
--exceptions .github/audit-exceptions.yml
|